feat(contract): Aside is the recommended driver for third-party web actions

The Third-Party Web Actions contract (ship, spec, office-hours,
land-and-deploy, setup-deploy) now names the Aside AI browser as the
recommended driver: it acts across the user's real logged-in sessions,
which is what vendor-dashboard moments need. Supersedes the v1.65.0.0
de-Aside stance by explicit user directive (2026-08-27).

Detection is a runtime probe (command -v + aside --version under a
portable gtimeout/timeout/bare guard; nonzero exit = not detected).
Consent options render per detection state with Aside recommended and
the first-party stack ($B headed + handoff, GStack Browser) as the
universal fallback. Absent on macOS, the contract mentions the
aside.com download (macOS 15+) once per task; gstack never runs an
installer and binary presence is never consent. Drive discipline:
step-wise over whole-task delegation, vendor confirm mode on, vendor
skill/--help text scoped to operational syntax only, secrets minimized
(autofill / human-used copy buttons), Apple credential creation never a
drive target in any skill, failure path quotes redacted errors and
falls back only with fresh consent.

test/third-party-actions.test.ts pins every load-bearing sentence (21
tests) plus repo-wide tripwires: an aside command allowlist
(--version/--help only, code spans AND prose) and a ban on Aside
installer invocations across all generated docs. Budget ratchet
fixture and carve skeleton ceilings refreshed in this commit per the
ratchet protocol.

test/fixtures/context-budget.json

@@ -3,21 +3,21 @@
   "alwaysOnTotal": 6344,
   "eagerPerInvocation": {
     "autoplan": 15370,
-    "benchmark": 4856,
+    "benchmark": 4931,
     "benchmark-models": 3829,
-    "browse": 7022,
+    "browse": 7097,
     "browser-skills/hackernews-frontpage": 371,
-    "canary": 9954,
+    "canary": 10029,
     "careful": 919,
     "codex": 14445,
     "context-restore": 8968,
     "context-save": 9585,
     "cso": 14558,
-    "design-consultation": 13019,
-    "design-html": 12875,
-    "design-review": 23600,
+    "design-consultation": 13094,
+    "design-html": 12950,
+    "design-review": 23675,
     "design-shotgun": 13061,
-    "devex-review": 14958,
+    "devex-review": 15033,
     "diagram": 3847,
     "document-generate": 11712,
     "document-release": 9510,
@@ -32,33 +32,33 @@
     "ios-fix": 8024,
     "ios-qa": 10593,
     "ios-sync": 8195,
-    "land-and-deploy": 14592,
+    "land-and-deploy": 15269,
     "landing-report": 8878,
     "learn": 8548,
     "make-pdf": 4957,
-    "office-hours": 17501,
-    "open-gstack-browser": 4429,
+    "office-hours": 18178,
+    "open-gstack-browser": 4504,
     "openclaw/skills/gstack-openclaw-ceo-review": 2764,
     "openclaw/skills/gstack-openclaw-investigate": 1429,
     "openclaw/skills/gstack-openclaw-office-hours": 4433,
     "openclaw/skills/gstack-openclaw-retro": 2542,
-    "pair-agent": 10898,
+    "pair-agent": 10973,
     "plan-ceo-review": 18893,
     "plan-design-review": 18334,
     "plan-devex-review": 16175,
     "plan-eng-review": 13114,
     "plan-tune": 14122,
-    "qa": 12615,
-    "qa-only": 12388,
+    "qa": 12690,
+    "qa-only": 12463,
     "retro": 17928,
     "review": 14407,
     "scrape": 3939,
-    "setup-browser-cookies": 3119,
-    "setup-deploy": 9708,
+    "setup-browser-cookies": 3194,
+    "setup-deploy": 10310,
     "setup-gbrain": 14915,
-    "ship": 18439,
+    "ship": 19041,
     "skillify": 11553,
-    "spec": 13276,
+    "spec": 13878,
     "sync-gbrain": 13336,
     "unfreeze": 393
   }